docs: add CLAUDE.md improvements and BRIDGE-WP-0001 workplan

- Expand CLAUDE.md with dev commands, architecture overview, and required prefix
- Add workplans/BRIDGE-WP-0001-initial-implementation.md: 8-phase implementation
  plan covering FRS FR-1 to FR-26 (23 tasks registered in Custodian State Hub,
  workstream bridge-wp-0001)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -1,3 +1,7 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
 # ops-bridge — Claude Code Instructions
 
 **Purpose:** SSH reverse tunnel lifecycle manager. Keeps remote execution
@@ -69,6 +73,50 @@ PRD: `workplans/BRIDGE-WP-0001-initial-implementation.md`
 - **No system daemons** — process management is internal, PID tracked in
   `~/.local/state/bridge/`
 
+## Dev Commands
+
+```bash
+# Install locally for development
+uv tool install -e .
+
+# Run tests
+uv run pytest
+
+# Run a single test
+uv run pytest tests/test_tunnel.py::test_name -v
+
+# Lint
+uv run ruff check .
+```
+
+## Architecture
+
+OpsBridge has two logical components:
+
+**1. OpsBridge — tunnel lifecycle manager** (this repo)
+Manages named SSH reverse tunnels defined in `~/.config/bridge/tunnels.yaml`.
+Each tunnel runs in a subprocess with a reconnect backoff loop; PIDs are tracked
+in `~/.local/state/bridge/`. Bridge states: `stopped → starting → connected →
+degraded → failed`. The `degraded` state means SSH is up but the optional HTTP
+health check is failing.
+
+**2. OpsCatalog — operations knowledge repository** (planned extension)
+A Git-backed YAML catalog of operations domains, targets, bridges, and actor
+classes. OpsBridge consumes this catalog to resolve bridge identifiers and
+orient operators. Schema examples are in `wiki/OpsCatalogSpecification.md`.
+The catalog layout follows: `opscatalog/domains/<domain>/{domain.yaml,
+targets/, bridges/, docs/}`.
+
+Key design constraints:
+- OpsBridge owns lifecycle management only; it does not own identity/credentials
+- Each tunnel is identified by name (e.g. `state-hub-coulombcore`); names used
+  in config, CLI args, and log filenames must stay consistent
+- Actor attribution (human operator vs. automation agent) is tracked per bridge
+  for audit log traceability (FRS §5.7)
+
+Specification docs are in `wiki/`: PRD (`OpsBridgePrd.md`), FRS
+(`OpsBridgeFrs.md`), and OpsCatalog spec (`OpsCatalogSpecification.md`).
+
 ## Repo boundary
 
 This repo owns **tunnel lifecycle management only**. It does not own: